I would like to find files accessed by specific user (even just read) within a folder tree. I thought the find
command had this option, but it actually just searches for owner user. Is there any other command, or command combinations? The stat
command offers access information, but doesn't display the user who made access.
-
2This thread might be interesting for you: stackoverflow.com/questions/4205815/…– wollud1969Dec 13, 2012 at 14:43
Add a comment
|
2 Answers
This information is not stored by traditional filesystems. You have three main options:
-
how does auditd compare with inotify, referenced above by wollud1969?– atroonDec 13, 2012 at 15:02
-
@atroon - Well, inotify can't notify you of which user did an action, so it seems irrelevant. Dec 13, 2012 at 21:58
-
Huh, so 'filesytem events' does not include users. Interesting. I read the descriptions thinking it might be useful without getting into the details of precisely which events and just presumed there would be something on who had touched the file last. Thanks.– atroonDec 14, 2012 at 13:55
As far as I know, the only way to perform this is by activating auditd in your system. this way, it will log the access to all files and you can grep the logs files.
Be careful as the logging will be "heavy".